hxxps://erp[.]ivyacademicnetwork[.]com[.]pk/vendor/repos/?themid=scatolincleiton@johndeere[.]com&file=1

Analysis

max time kernel
55s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://erp.ivyacademicnetwork.com.pk/vendor/repos/[email protected]&file=1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1228	1856	chrome.exe	28
PID 1856 wrote to memory of 1228	1856	chrome.exe	28
PID 1856 wrote to memory of 1228	1856	chrome.exe	28
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2736	1856	chrome.exe	33
PID 1856 wrote to memory of 2832	1856	chrome.exe	32
PID 1856 wrote to memory of 2832	1856	chrome.exe	32
PID 1856 wrote to memory of 2832	1856	chrome.exe	32
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30
PID 1856 wrote to memory of 2688	1856	chrome.exe	30

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://erp.ivyacademicnetwork.com.pk/vendor/repos/[email protected]&file=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6659758,0x7fef6659768,0x7fef6659778
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2248 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2256 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1224 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:2
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1392 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 --field-trial-handle=1160,i,6422234252112967142,3512029455899596830,131072 /prefetch:8
  2⤵
  PID:3016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e09f7b3e5f4c6529f7e089c6305294b5

SHA1
4e1385afc86839a97e9dbccb05d0b69b27c55615

SHA256
7646b988269954b31ca20e1863ed475c1f6cc545c0cccdc347e4f7f7bfc2de03

SHA512
b2566b472bc92161601ec9c325b054101220ec85ef65971916da5021056512452f382af6c98067f44fe72bfb94301a360e3e209c20e16d03cce8227648e6e53e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13501aece77d033784ced0e981e0f01d

SHA1
0ae570441dd04d9375a80734ceaeabadf76a1305

SHA256
9b08ab9d0c98d986118dd9aeb519b5771e6f1caddd0697ba201ddb06adb286d3

SHA512
7fbb80e5a4b2ded21dece55ed619de783586869f8fe3a233daa8e93eb154dbe943d59157975983fc68ffe6c385813dc0fae50e49aaaf41c08ec2c6275d643302

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
14950f123ba66df53d594d3ea061ef7b

SHA1
18bd838c75eb1bfd2ad83955e1caedf517ab8cab

SHA256
ee01bc83d8a82903e3dfdb121a257b2046232156bcbcf9c89dc54d29dd2b15da

SHA512
9a8fe5b7a00bc3ba5cdf04dec88c8521d2dafba462134ae5f66deb19e6b929ac1f204f5bf957844225a5d7f7952c27624a53b2eb67071ebb08dcaa4a37fb41ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
99e67dec46a3b8c510fa18e2b81f32d4

SHA1
e60b48be7a24aaeba51f9ae464b96170ccb0dc26

SHA256
a969950fc4a3572c3662ef87b35272ce65a57dda142758a92212c5ab90e819bd

SHA512
b5290aa8e22951810d88257090bd479b91255a2e1be7172dc67020075606f6001ec14c512a45fd0cf42a5d4da2795a0b8a87a680c49cbf5d8e17fbaca1597086

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
5a80af7028edb26c42a60c627ac09560

SHA1
c5cb5af39b985f38926a1625285dfe55d69b2934

SHA256
be3308dd402640de04f5c190eee74feaf6ad8fd5f1940487d9244385d56bf99a

SHA512
cafb08953bbe944a80a8d0efb237e269dd416185822b5981082f8960fd292b23f69149ead93d8956e83510651914835096e9212ce457983f7ee0dae09eb222f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit